snakekeylogger | ff7c332b77194f5bafb276ac4eaa038e5014d8bc546cb49b565156581cef3449

Analysis

max time kernel
155s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
12/04/2022, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
duONZIw23uNXjKY.exe
Size 572KB
Sample220412-gcv34afdfl
SHA256 ff7c332b77194f5bafb276ac4eaa038e5014d8bc546cb49b565156581cef3449
MD5 bfdc4a7009d813394e0889036fafc421
SHA1 7ddae09a11fc537300bd9d4986ee92b9c7c70cc8
SHA512 d2efd8eb3a030a5ebc1cbd0f933d15ee0f0a2f63e38f776eb4bc3e78ce2bba690089cba5a275956700c5f5a73c0362d66db0c7a9493db29819e1282034695765
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5243953302:AAGFyxwcILx3S0Gq834R9NN-9m6enfFssYk/sendMessage?chat_id=5255359287

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3852-136-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	duONZIw23uNXjKY.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	checkip.dyndns.org
55	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3056 set thread context of 3852	3056	duONZIw23uNXjKY.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
384	3852	WerFault.exe	89
4864	3852	WerFault.exe	89

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2256	powershell.exe
3852	duONZIw23uNXjKY.exe
2256	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	3852	duONZIw23uNXjKY.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2256	3056	duONZIw23uNXjKY.exe	85
PID 3056 wrote to memory of 2256	3056	duONZIw23uNXjKY.exe	85
PID 3056 wrote to memory of 2256	3056	duONZIw23uNXjKY.exe	85
PID 3056 wrote to memory of 3068	3056	duONZIw23uNXjKY.exe	87
PID 3056 wrote to memory of 3068	3056	duONZIw23uNXjKY.exe	87
PID 3056 wrote to memory of 3068	3056	duONZIw23uNXjKY.exe	87
PID 3056 wrote to memory of 3852	3056	duONZIw23uNXjKY.exe	89
PID 3056 wrote to memory of 3852	3056	duONZIw23uNXjKY.exe	89
PID 3056 wrote to memory of 3852	3056	duONZIw23uNXjKY.exe	89
PID 3056 wrote to memory of 3852	3056	duONZIw23uNXjKY.exe	89
PID 3056 wrote to memory of 3852	3056	duONZIw23uNXjKY.exe	89
PID 3056 wrote to memory of 3852	3056	duONZIw23uNXjKY.exe	89
PID 3056 wrote to memory of 3852	3056	duONZIw23uNXjKY.exe	89
PID 3056 wrote to memory of 3852	3056	duONZIw23uNXjKY.exe	89
PID 3852 wrote to memory of 384	3852	duONZIw23uNXjKY.exe	99
PID 3852 wrote to memory of 384	3852	duONZIw23uNXjKY.exe	99
PID 3852 wrote to memory of 384	3852	duONZIw23uNXjKY.exe	99

C:\Users\Admin\AppData\Local\Temp\duONZIw23uNXjKY.exe
"C:\Users\Admin\AppData\Local\Temp\duONZIw23uNXjKY.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UKKSZWf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UKKSZWf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4537.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\duONZIw23uNXjKY.exe
  "C:\Users\Admin\AppData\Local\Temp\duONZIw23uNXjKY.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1528
    3⤵
    - Program crash
    PID:384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1528
    3⤵
    - Program crash
    PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3852 -ip 3852
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

duONZIw23uNXjKY.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\duONZIw23uNXjKY.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

tmp4537.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4537.tmp
Size 1KB
SHA256 992b2f12d135151e773906c8c8c351fd3d98e819352ab151d80e37256fe3a117
MD5 fc3946b9d729c3141389c6246df16369
SHA1 64883534ea03ebf90e643fd947b0d710905a01bb
SHA512 53ce56f93a5e6b3c68e619282c6359d574b45d2fdb44f18d9b2ad8fec74c5bb414a37a3c1d837dc8af19c02a5cc48b4a2fa9708948f22cd06cc5c441ffd0a2f2
MD5 SHA1 SHA512

Submit Download

memory/2256-145-0x0000000007AF0000-0x000000000816A000-memory.dmp

Download

memory/2256-146-0x00000000074A0000-0x00000000074BA000-memory.dmp

Download

memory/2256-151-0x00000000077C0000-0x00000000077C8000-memory.dmp

Download

memory/2256-150-0x00000000077E0000-0x00000000077FA000-memory.dmp

Download

memory/2256-132-0x00000000027F0000-0x0000000002826000-memory.dmp

Download

memory/2256-149-0x00000000076D0000-0x00000000076DE000-memory.dmp

Download

memory/2256-148-0x0000000007720000-0x00000000077B6000-memory.dmp

Download

memory/2256-135-0x0000000005500000-0x0000000005B28000-memory.dmp

Download

memory/2256-147-0x0000000007510000-0x000000000751A000-memory.dmp

Download

memory/2256-144-0x0000000006740000-0x000000000675E000-memory.dmp

Download

memory/2256-138-0x0000000005170000-0x0000000005192000-memory.dmp

Download

memory/2256-139-0x0000000005210000-0x0000000005276000-memory.dmp

Download

memory/2256-140-0x00000000061B0000-0x00000000061CE000-memory.dmp

Download

memory/2256-141-0x0000000004EC5000-0x0000000004EC7000-memory.dmp

Download

memory/2256-142-0x0000000006760000-0x0000000006792000-memory.dmp

Download

memory/2256-143-0x0000000070920000-0x000000007096C000-memory.dmp

Download

memory/3056-126-0x0000000004D30000-0x0000000004DC2000-memory.dmp

Download

memory/3056-124-0x00000000002D0000-0x0000000000364000-memory.dmp

Download

memory/3056-128-0x0000000006DF0000-0x0000000006E8C000-memory.dmp

Download

memory/3056-127-0x0000000004EE0000-0x0000000004EEA000-memory.dmp

Download

memory/3056-129-0x0000000007050000-0x00000000070B6000-memory.dmp

Download

memory/3056-125-0x0000000005240000-0x00000000057E4000-memory.dmp

Download

memory/3852-136-0x0000000000400000-0x0000000000426000-memory.dmp

Download